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Method for generating digital watermarks and for exchang- 
ing data containing digital watermarks 

5 The present invention relates to a method for 

generating digital watermarks and for transmitting data 
containing digital watermarks according to the preamble 
of the independent claims. 

Digital watermarking is a method for marking 

10 data sets, such as images, sound or video. A digital wa- 
termark consists of a slight modification of the data set 
that does not affect the data set's usability but that 
can be detected using dedicated analysis software or ap- 
paratus. Watermarking can e.g. be used for marking 

15 authorship or ownership of a data set. 

Digital watermarking can be seen as a funda- 
mental-problem in digital communications (see e.g. I. 
Cox, J. Killian, T. Leighton, and T. Shamoon, "Secure 
spread spectrum communication for multimedia", Technical 

20 report, N.E.C. Research Institute, 1995) . Early methods 
of encoding watermarks consisted of no more than incre- 
menting an image component to encode a binary and 
decrementing to encode a *0' (G. Caronni "Assuring Owner- 
ship Rights for Digital Images" in H. H. Brueggemann and 

25 W. Gerhardt-Haeckl, editors, Reliable IT Systems VIS '95, 
Vieweg Publishing Company, Germany, 1995). Tirkel et al. 
(A. Z. Tirkel, G. A. Rankin, R. G. van Schyndel, W. J. 
Ho, N. R. A. Mee, and C. F. Osborne, ^Electronic water- 
mark", in Dicta-93, pages 666-672, Macquarie University, 

30 Sydney, December 1993) and van Schyndel et al . (A. Z. 
Tirkel, R. G. van Schyndel, and C. F. Osborne, "a two- 
dimensional digital watermark", in ACCV 95, pages 378- 
383, University of Queensland, Brisbane, December 6-8 
1995) have applied the properties of m-sequences to pro- 

35 duce oblivious watermarks resistant to filtering, crop- 
ping and reasonably robust to cryptographic attack. Mat- 
sui and Tanaka (K. Matsui and K. Tanaka, "Video- 
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Steganography : How to secretly embed a signature in a 
picture", in IMA Intellectual Property Project Proceed- 
ings, pages 187-206, January 1994) have applied linear 
predictive coding for watermarking. Their approach to 
5 hiding a watermark is to make the watermark resemble 

quantization noise, Tirkel and Osborne (see above) were 
the first to note the applicability of spread spectrum 
techniques to digital image watermarking. Since then 
there has been an increasing use of spread spectrum in 

10 digital watermarking. It has several advantageous fea- 
tures, such as cryptographic security (see Tirkel and Os- 
borne, above) , and is capable of achieving error free 
transmission of the watermark near or at the limits given 
by the maximum channel capacity (J. Smith and B. 

15 Comiskey, "Modulation and information hiding in images", 
in Ross Anderson, editor, Proceedings of the First Inter- 
national Workshop in Information Hiding, Lecture Notes in 
Computer Science, pages 207-226, Cambridge, UK, May/June 
1996, Springer). Fundamental information theoretic limits 

20 to reliable communication have been discussed by some 

authors (see Smith and Comiskey, above) . The shorter the 
paylee'd^-e^-a^we^e^ma^k^ the bett<e*r-a*r*e- ^ke^@h»©es- -of it 
being communicated reliably. Spread spectrum is an exam- 
ple of a symmetric key cryptosystem (B. Schneier, 

25 "Applied Cryptography", Wiley, 2nd edition, 1995) . System 
security is based on proprietary knowledge of the keys 
(or pseudo random seeds) which are required to embed, ex- 
tract or remove an image watermark. One provision in the 
use of a spread spectrum system is that it is important 

30 that the watermarking be non-invertible because only in 
this way can true ownership of the copyright material be 
resolved (S. Craver, N. Memon, B. Yeo, and M. Yeung, "Can 
invisible marks resolve rightful ownerships ?", IS&T/SPIE 
Electronic Imaging x 97 : "Storage and Retrieval of Image 

35 and Video Databases", 1997). 6 Ruanaidh et al . (J. K. 6 
Ruanaidh, W. J. Dowling, and F. M. Boland, "Phase water- 
marking of images", IEEE International Conference on Im- 
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age Processing, Lausanne, Switzerland, September 1996) 
and Cox et al. (see above) have developed perceptually 
adaptive transform domain methods for watermarking. In 
contrast to previous approaches listed above the emphasis 
5 was on embedding the watermark in the most significant 
components of an image. The general approach used in 
these papers is to divide the image into blocks. Each 
block is mapped into the transform domain using either 
the Discrete Cosine Transform (W. B. Pennebaker and J. L. 

10 Mitchell, "JPEG Still Image Compression Standard", Van 
Nostrand Reinhold, New York, 1993) , the Hadamard Trans- 
form (W. G. Chambers, "Basics of Communications and Cod- 
ing", Oxford Science Publications. Clarendon Press Ox- 
ford, 1985) or the Daubechies Wavelet Transform (W.H. 

15 Press, S.A. Teukolsky, W.T. Vetterling, and B.P. Flan- 
nery, "Numerical Recipes in C", Cambridge University 
Press, second edition, 1992) . Information has been embed- 
ded using the DCT (J. J. K. 6 Ruanaidh, W. J. Dowling, 
and F. M. Boland, "Watermarking digital images for copy- 

20 right protection", IEEE Proceedings on Vision, Image and 
Signal Processing, 143(4) : 250-256, August 1996, based on 
the paper of the same title at the IEEE Conference on Im- 
age Processing and Its Applications, Edinburgh, July 
1995) FFT magnitude, and phase, Wavelets (see refs. of 

25 Ruanaidh, Dowling and Boland, above), Linear Predictive 
Coding (see Matsui et al . , above) and fractals (P. Davern 
and M. Scott, "Fractal based image steganography", in 
Ross Anderson, ed., Proceedings of the First Interna- 
tional Workshop in Information Hiding, Lecture Notes in 

30 Computer Science, pp. 279-294, Cambridge, UK, May/June 
1996. Springer Verlag) . 

The industrial importance of digital water- 
marking has resulted in a number of products on the mar- 
ket, either based on spread spectrum techniques or addi- 

35 tional registration services. They include the Picture- 
marc system by Digimarc, SureSign (former FBI's Finger- 
print) by HighWater Signum, IP2 system by Intellectual 
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Protocols, the Argent system by Digital Information Com- 
modities Exchange, the PixelTag system by the MIT Media 
Lab, the SysCop system from Zhao and Koch by the Frauen- 
hof er-Institut fur Graphische Datenverarbeitung (J. Zhao 
5 and E. Koch, "Embedding robust labels into images for 
copyright protection", Technical report, Fraunhofer In- 
stitute for Computer Graphics, Darmstadt, Germany, 1994. 
J. Zhao, "A WWW Service To Embed And Prove Digital Copy- 
right Watermarks", Proc. Of the European Conference on 
10 Multimedia Application, Services and Techniques, Louvain 
La-Neuve, Belgium, May 1996) , and the Tigermark system 
from NEC. 

The approach of Zhao and Koch, based on the 
JPEG image compression algorithm, proceeds by segmenting 

15 the image into individual 8x8 blocks. Only eight coef- 
ficients occupying particular positions in the 8x8 
block of DCT coefficients can be marked. These comprise 
the low frequency components of the image block but ex- 
clude the mean value coefficient as well as the low fre- 

20 quencies. Three of the remaining DCT coefficients are se 
lected using a pseudo random number generator to convey 

®*3?«ma*t4*©'n>. -T*he^-~2?os^ -fre- 
quency hop spread spectrum communications is also men- 
tioned and the blocks are placed at random positions in 

25 the image. A WWW registration service has been proposed 
for a local registration and a local watermarking, for a 
server registration and a server watermarking, and for a 
local watermarking and a server registration. 

J.-F. Delaigle at al. (J.-F. Delaigle, J.-M. 

30 Boucqueau, J. -J. Quisquater & B. Macq, "Digital Images 
protection techniques in a broadcast framework: An over- 
view", Laboratoire de Telecommunications et de Tele- 
dection, Universite Catholique de Louvain) have applied 
signature labelling techniques for the copyright protec- 

35 tion of digital images. Their approach is based on an en 
hanced image format and generates a digital signature la 
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bel in front of the image. This signature label can be 
easily overwritten or destroyed. 

It is an objective of the present invention 
to provide a system of the type mentioned initially that 
5 provides a simple and secure way of generating and trans- 
mitting watermarked data. 

In one aspect of the invention, this object 
is achieved by using an asymmetric private and public key 
pair, as it is used in cryptography. The original data 

10 set (cover data set, cover image) is watermarked, wherein 
the watermark is encoded using one or both of said keys. 
The watermarked data set (stego data set, stego image) is 
then transmitted to a second party, wherein the same keys 
are used for establishing a secure transmission between 

15 the parties. This simplifies the administration of keys 
since the only keys required are the key pair mentioned 
above. In addition to this, because cryptographic keys 
are less prone to guessing attacks than simple passwords, 
the security of the watermark is improved. 

20 In a preferred embodiment, both parties use 

asymmetric key pairs and a key protocol for establishing 
a common key between them. 

The party creating the watermark can embed a 
private as well as a public watermark in the data set, 

25 wherein the private watermark is derived from the private 
key, the public watermark from the public key. The public 
watermark can be detected by third parties while the pri- 
vate watermark can only be detected using private infor- 
mation. Preferably, the private watermark is not derived 

30 from the private key directly but from a hash value of 
the same, such that the author of the watermark does not 
have to reveal his private key if the private watermark 
is to be verified. 

In a further aspect of the invention, the 

35 author of the watermark is again provided with an asym- 
metric cryptographic key pair. He embeds a message to- 
gether with its cryptographic signature in the watermark. 



When verifying this watermark, the presence of the signa- 
ture increases reliability because it proves that the 
message was signed by the author. 

In yet another aspect of the invention, the 
cover data set is provided with a digital watermark and 
then transmitted to a registration party that permanently 
stores at least a hash value, time information and origin 
of the stego data set. 

In another aspect of the invention, a tem- 
plate modulation pattern is added to the Fourier trans- 
form of an image that is to be provided with a watermark. 
For checking the watermark, the Fourier transform of the 
stego-image is calculated. From this Fourier transform, 
the log polar mapping transform is generated, which is 
then searched for the modulation pattern. Using the log 
polar transform of the Fourier transform has the advan- 
tage that scaling and rotation of the stego image are ex- 
pressed in translations. This allows an easy search for 
rotation and scaling using cross-correlation techniques. 

In still another aspect of the invention, the 
image to be watermarked is divided into blocks and the 
magnitude components of the Fourier transform of each 
block is modulated using the same pattern. This method 
provides robustness against cropping of the stego-image 
because a cropping leads to a circular translation in 
each block. Preferably, the magnitude components of the 
Fourier transform are modulated, wherein the sign of the 
modulation should be derived from the phase components, 
thereby reducing interference between the image data and 
the watermark as explained in the following disclosure. 

Further aspects, advantages and applications 
of the invention are described in the claims and the fol- 
lowing description, which description makes reference to 
the figures. They show: 

Fig* 1 the parties involved in individual wa- 
termark protection, 
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Fig. 2 the parties involved in watermark pro- 
tection using registered cryptographic keys, 

Fig. 3 the parties involved in watermark pro- 
tection using registered cryptographic keys and a regis- 
5 tration party, 

Fig. 4 the steps taken for embedding a water- 
mark, 

Fig. 5 the steps for generating the template, 

Fig. 6 the steps for reading a watermark, 
10 Fig. 7 the steps for reading the template, 

Fig. 8 the tiling of the watermark in a 
stego-image, and 

Fig. 9 the tiling of the watermark in a 
cropped stego-image . 

15 

I. Terms and Symbols: 



Before describing a preferred method and ap- 
paratus according to the invention, some key terms and 
20 symbols used in its description are explained in the fol- 
lowing : 

" Image " : An image in either digital or physi- 
cal form which may constitute a still image or a video 
frame. It can also refer other types of data, such as 
25 video and sound, in particular when being used within the 
context of the protection and owner authentication meth- 
ods of section II of the disclosure. 

" Signal " : A signal in either digital or 
physical form. It may refer to one dimensional or multi- 
30 dimensional signals such as image and video. 

" Image Copyright Holder (ICH) ": A party (or a 
process acting on behalf of it) "owning" a digital image. 
This is the party that generates the watermarks. 

" Image Buyer (IB) ": A party (or a process 
35 acting on behalf it) which obtains (e.g. by purchase) via 
electronic means a specific image from the ICH. 
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" Image Authentication Process (IAP) ": A proc- 
ess for verifying that the image has been processed 
(generation, storage, retrieval, modification, transmis- 
sion) before by the ICH. 
5 " Image Authentication Data (IAD) " : The 

authentication data used in the IAP. 

" Stego " : Implies that an image or data is 
marked (i.e. it has an IAD embedded in it). The stego im- 
age is also referred to as the stego data set. 

10 " Cover " : Implies that an image or data is un- 

marked (i.e. it has no IAD embedded in it). The cover im- 
age is also referred to as the cover data set. 

" Watermark " : The form the IAD takes when it 
is in a form suitable for embedding in a signal. 

15 " Image Copyright Office (ICQ) ": An organiza- 

tion (or a process which acting on behalf it) which reg- 
isters ownership for a specific image. Successful regis- 
tration is based on a verification procedure, e.g. by 
checking the name and postal address of CH, information 

20 how ownership was acquired, the title of the image, a de- 
scription of the type of image (artistic, literary, musi- 
ealr, -d h raw first publication . 

After successful registration a digital copyright cer- 
tificate can be generated. 

25 " Digital copyright certificate ": Digital 

copyright data which comprise the copyright certificate 
data and a digital signature. 

" Copyright Request Data (CRD) ": Copyright 
data which contains the stego image, the image ID of the 

30 cover image, a Universal Copyright Convention Notice, a 
Copyright Symbol, the term 1 1 Copyright ,f , the year of the 
copyright, the name of the copyright holder, and the 
phrase f 'All Rights Reserved' 1 . 

" Copyright Certificate Data (CCD) " : Copyr i ght 

35 data which contains at least an image ID, a hash value of 
the digital image, a time stamp, a Universal Copyright 
Convention Notice, a Copyright Symbol, the term ' 'Copy- 




right' ' , the year of the copyright, the name of the copy- 
right holder, and the phrase 1 T A11 Rights Reserved' 1 . 

" Digital signature " : A data string which has 
been generated by a digital signature generation trans- 
5 formation. 

" Digital signature generation transforma- 
tion " : A method for producing a digital signature. 

" Digital signature verification transforma- 
tion " : A method for verifying whether a digital signature 
10 is authentic or not. 

" Digital signature scheme ": A scheme based 
on asymmetric cryptographic techniques whose private 
transformation is used for the digital signature genera- 
tion and whose public transformation is used for the 
15 digital signature verification. 

" Digital signature scheme with message recov- 
ery " : A digital signature scheme for which a priori 
knowledge of the input data is not required for the sig- 
nature verification transformation. 
2 0 " Digital signature scheme with appendix ": A 

digital signature scheme for which the input data is re- 
quired as input to the digital signature verification 
transformation . 

" Asymmetric key pair ": A pair of related 
25 cryptographic keys where the private key defines the pri- 
vate transformation and the public key defines the public 
transformation . 

" Symmetric key ": A cryptographic key used 
with a symmetric cryptographic technique and known only 
30 to a set of specified entities. 

" Asymmetric key agreement protocol ": A proto- 
col whereby a shared symmetric key becomes available to 
two parties for subsequent cryptographic use. The symmet- 
ric key is exchanged on the basis of a digital signature 
35 scheme with message recovery. The signed keys are en- 
crypted with an asymmetric public key. 
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" Public Key Infrastructure (PKI) ": An organi- 
zation (or processes which acts on behalf of it) which 
offers services for the generation, registration, certi- 
fication, distribution, validation, and revocation of a 
5 certificate associated with an asymmetric key pair. 

" Public watermark ": A watermark that can be 
detected using a publicly available key (or a hash value 
thereof) . 

" Private watermark ": A watermark that can 
10 only be detected using a secret key (or a hash value 
thereof) . It is not possible for an unauthorized third 
party to overwrite or delete the private watermark with- 
out the cryptographic secret keying information. 

" Embedded authentication data ": The hidden 

15 IAD. 

" Payload " : The core of the hidden IAD in bit 
form without error control coding applied. 

" Image ID ": The following format scheme for a 
globally unique ID: The first 3 bytes determine the ICO, 
20 the following 3 bytes determine the ICH ID defined by the 
ICO. Finally the ICH can freely assign last 4 bytes for 
eae^ ,j ®'H»e' >®&^^ ^ 

" Oblivious " : A watermarking technique which 
does not require the cover image for extracting the mark. 
25 In other words, only the stego image is required to ex- 
tract the mark when using an oblivious marking scheme. 

" Template " : A hidden message encoded in the 
image. By detecting the template, the scaling (zooming) 
and rotation suffered by a stego-image can be determined. 
30 " Pseudo random seed ": A value used to ini- 

tialize a pseudo random number generator. 



Symbols : 

35 H distinguished (unique) name of the Image Copyright 

Holder H 

0 distinguished name of the Image Copyright Office O 

B distinguished name of the Image Buyer B 
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I distinguished name of the Public Key Infrastructure 

CertH entity H's public key certificate from I 
Certo entity O's public key certificate from I 
CertB entity B's public key certificate from I 
5 (px /^x) the elliptic curve key pair, with a key size of 
at least 209 bits, of an entity with the distin- 
guished name X* See Alfred J. Menezes, Paul C. Van 
Oorschot, and Scott A. Vanstone, "Handbook of Ap- 
plied Cryptography", CRC Press, 1996, ISBN 0-8493- 
10 8523-7 

CC a copyright certificate 
KS key size of the elliptic curve pair 
DSSMRq (X, Y, Z ) an elliptic curve based digital signature 
generation scheme with message recovery, where X 
15 denotes the private key, Y the input data to be 

signed, and Z the resulting signature, 
DSSMRy (X, Y, Z ) an elliptic curve based digital signature 
verification scheme with message recovery, where X 
denotes the public key, Y the input data, and Z the 
20 resulting output data. 

DSSAP G (X, Y, Z) an elliptic curve based digital signature 
generation scheme with appendix, where X denotes 
the private key, Y the input data to be signed, and 
Z the resulting signature. 
25 DSSAPy (X, Y, Z) an elliptic curve based digital signature 
verification scheme with appendix, where X denotes 
the public key, Y the input data, and Z the result- 
ing output data. 
Kxy a secret key for a symmetric cryptosystem shared 
30 between two entities with the distinguished name X 

and Y. 

KxY [Data] denotes the cipher text generated by a symmet- 
ric cryptosystem with plain text Data, 
crh a collision resistant hash function 
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AKAP (X, Y,KxY/PSX , vs x , pc x , vc X /PS Y / vsy, PCy, vc Y ) ap- 
plied asymmetric key agreement protocol (see ISO/ 
IEC 11770-3, ^Information technology-Security tech- 
niques-Key management, Part 3: mechanisms using 
5 asymmetric techniques") with entity X' s private 

signature key ps x , entity X's public verification 
key vs x , entity X's private deciperment key pc x , 
entity X's public encipherment key vc x , entity Y' s 
private signature key psy, entity Y' s public veri- 

10 f ication key vsy, entity Y' s private decipherment 

key pcy, and entity Y' s public encipherment key vcy 
between the entities with the distinguished name X 
and Y. After the protocol was successfully exe- 
cuted, the two entities have agreed on a K X y. 

15 OIAE (X,Y /CI, SI) the oblivious image owner authentication 
embedding algorithm with the seed X, the payload Y, 
the cover image CI, and the resulting stego image 
SI . 

OIAV(X,SI,Y) the oblivious image owner authentication de- 
20 tection algorithm with the seed X, the stego image 

SI, and the resulting payload Y) 
TVP . t ime - variant p A a^a^e*ti»^ i=t r anjdom numfeej , t a 

time-stamp, or a sequence number. 
I | concatenation of two data elements in this order. 
25 CI Cover Image 
SI Stego Image 

II. Protection and owner authentication: 

30 Depending on the proof-level to be provided 

for the protection, the preferred embodiment of the appa- 
ratus and method according to the invention provides 
three different levels of reliability, which are based on 
each other, namely: individual watermark protection, wa- 

35 termark protection with registered cryptographic keys, 

and watermark protection with an ICO on the basis of reg- 
istered cryptographic keys. 
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The present method and apparatus is based on 
an image owner authentication technique, described below, 
which embeds and detects the IAD as the payload of a wa- 
termark. The applied image owner authentication technique 
5 is based on a perceptually adaptive spread spectrum tech- 
nique which provides reliable means of embedding robust 
watermarks. Such a technique will be discussed in section 
III. In addition, a spread spectrum techniques is a form 
of symmetric cryptosystem. In order to embed or extract a 

10 watermark, it is necessary to know the exact values of 
the seed used to produce pseudo random sequences used to 
encode a watermark. The seeds are considered to be cryp- 
tographic keys for watermark generation and verification. 
System security can therefore be based on proprietary 

15 knowledge of the keys and provide in addition the neces- 
sary security parameters needed for a secure communica- 
tion (mutual authentication, integrity, confidentiality, 
non-repudiation) in the trading process of digital im- 
ages. Because spread spectrum signals are statistically 

20 independent (and therefore virtually orthogonal) , the 

present method and apparatus encodes more than one water- 
mark in an image at the same time, namely private water- 
marks and public watermarks. The public watermarks indi- 
cate that the image is copyright material and provide in- 

25 formation on true ownership. At the same time there are 
secure private watermarks whose secrecy depends on the 
private key of the asymmetric key pair of the ICH. 

Since the system provides for the registra- 
tion of the public key of the asymmetric key pair, the 

30 ICH can prove that he is the only person in the posses- 
sion of the adequate private key of the asymmetric key 
pair and, therefore, the generator of the private water- 
marks . 

The system also provides the secure registra- 
35 tion (mutual authentication, integrity, confidentiality, 
non-repudiation) of watermark encoded images (data sets) 
at an ICO. The stego image is registered at the ICO and a 
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digital copyright certificate is generated which is 
signed by the ICO. If an unauthorized third party has 
also encoded watermarks in the same image, conflicting 
claims in copyright disputes can be resolved. Examining 
5 the time stamps of the copyright certificate enables the 
secure identification of the legal owner: The earliest of 
the time stamps identifies the legal owner if no copy- 
right revocation request has been applied. 

Watermark protection with registered crypto- 

10 graphic keys and the ICO based copyright protection are 
based on a PKI . The PKI issues on request public key cer- 
tificates containing the public key of the party, the 
distinguished name of the party, and a time stamp. Every 
certificate is signed with the PKI's private key and the 

15 trust is built on the validity of the authentic copy of 
the PKI's public key (we assume that the public key of 
the PKI is accessible, authentically distributed, and 
verifiable by every party) . 

In the following the three levels of the sys- 

20 tern are described. 

-^a*)^I*n'd^ wa^e-rmar k prote et-ion 

As shown in Fig. 1, the apparatus for the in- 
dividual copyright protection is partitioned into two 
25 processes, namely the ICH with the distinguished name H 
and the IB process with the distinguished name B. Suppose 
(ps H ,vs H ) and (pc H / vch) are the elliptic curve key pairs 
of H, (ps b ,vsb) and (peg, vc B ) are the elliptic curve key 
pairs of B. Suppose H has an authentic copy of vsg, veg 
30 and B has an authentic copy of vsjj/ v ^h before they start 
any communication. 

The following phases are applied by the proc- 
esses of the individual copyright protection apparatus: 
Phase 1: 

35 H retrieves the cover image CI, generates a unique image 
identifier ID CI , stores ID CI , and retrieves the key pair 
(ps H , vs H ) . 




Phase 2 (generating private watermark) : 
1 . H generates a private IAD^i applying 
DSSMR G (ps H/ ID CI , IAD CI ). 

2. H partitions, depending on the key size KS, the IAD CI 
5 into different blocks BL^, 1 < i < P, with a length of 

128 bits (P := TlAD^i /KS~1) . This ensures that the blocks 
to be included in each watermark are sufficiently small. 

3. H generates the stego image SI applying for every 
i, 1 < i < P, using the transformation: 

10 OIAE (crh (ps H ) XOR crh(i), BL±, CI±, SI±) , 

where CI± denotes the cover image (stego image from the 
previous iteration, CIi := CI) and SI± denotes the stego 
image of iteration i. The resulting stego image is then 
SI := Sip. Set CI* := SI. 

15 Phase 3 (generating public watermark) : 
H generates a public IADqj applying 

DSSMR G (ps H , CD, IAD CI ), 
with CD := "Copyright by"l I h) I TVPl I "All Rights Reserved". 
H again partitions, depending on the key size KS, the 

20 IAD CI into different blocks BL±, 1 < i < P, with a length 
of 128 bits (P := flAD CI /Ksl) . 

H generates the stego image SI applying for every 
i, 1 < i < P, the following transformation: 
OIAE(crh(vs H ) XORcrh(i), BL^, CI±, SI±) , 
25 where CI^ is the cover image (stego image from the previ- 
ous iteration, CIi = CI*, with CI* from the previous 
phase) and SIj_ is the stego image of iteration i. The re- 
sulting stego image is SI = Sip. 
Phase 4: 

30 H stores the resulting stego image SI and may generate a 
signed copyright certificate. 
Phase 5: 

H and B execute the following steps for the trading of 
copyright protected digital images: 
35 1 . H and B execute 

AKAP (H, B, K HB , ps H , vs H , pc H , vc H / PS B ^ vs B , pc B , 

vc B ) 
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for the generation of a shared symmetric session key K^ B . 

2. B generates the trading transaction Tl, 
Tl := <K HB [TD|| SigTD]>, with 

TD := ID CI II TVpIIbII H, and 
5 DSSAP G (ps B , TD, SigTD) . 

B then transmits Tl to H. 

3. H receives Tl, deciphers K HB [TD| I SigTD], and verifies 
TD, applying 

DSSAP v (vs B , SigTD, IVR) 
io where IVR denotes the intermediate verification result. 
If 

IVR = crh(TD), with TD := ID CI | I TVP| I b| I H, 
then TD has been successfully verified and the next step 
shall be executed. In any other case, the processing and 
15 communication between the H and B is stopped. 

4. If the verification was successful, H retrieves with 
the IDcj information the corresponding stego image SI and 
generates the trading transaction 

T2 := <K HB [TE)|I SigTD]>, with 
20 TD := SI MtvpIIhIIb, and DSSAP G (ps H , TD, SigTD). 

H then transmits T2 to B. 

5 * &~*&&®efcv&& -T«2^ ^eciphe^s- K^g[^©l h l^^g^®]T*^a^d ^ e ^i*i*e-s 
TD, applying 

DSSAP v (vs H/ SigTD, IVR), 

25 where IVR denotes the intermediate verification result. 
If IVR = crh(TD), with TD := Sill TVPlI hII B, then TD has 
been successfully verified. B then checks the IAD apply- 
ing for every i, 1 < i < P, the following transformation: 
OIAV(crh (vs H ) XORcrh(i), SI, PLjJ, 

30 where SIj_ denotes the stego image and PLj_ the detected 

payload of the i-th public watermark. (If P is not known, 
the procedure is iteratively applied until no more public 
watermark can be detected) . The IADci is then generated 
by concatenating the PL^, i.e. 

35 IAD CI := PLill PL 2 II • . .11 PL N/ 1 < i < P. 

IADci is then verified applying 
DSSMR v (vs H/ IAD CI/ OD) , 
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with OD as the output data. If OD is 

"Copyright by"| I h| I TVPl I "All Rights Reserved", 
B has verified H as the copyright holder, if the public 
watermarks have not been modified (overwritten) . 

5 

Remark : 

In the case of a legal copyright dispute, H 
can retrieve the IAD^j and construct the corresponding 
unique image ID. Since the generation of the same asym- 

10 metric key pair by two distinguished entities is very un- 
likely, the construction of the unique image ID provides 
a good level of proof against copyright infringement. In 
the case of watermark protection with registered keys, 
the generation of the same asymmetric key pair by two 

15 distinguished entities can be prevented. 

Depending on the applied asymmetric scheme 
the private decipherment key may be identical to the pri- 
vate signature key and the public encipherment key may be 
identical with the public verification key. 

20 

b) Watermark protection with registered keys: 
As shown in Fig. 2, the apparatus for the 
copyright protection with registered cryptographic keys 
is partitioned into three processes, namely the ICH with 

25 the name H, the IB process with the name B, and the PKI 
process with the - name I. Suppose (psh,vsh)/ (P C H' VC H)' 
(ps B , vs B ), (pc B , vc B ) , (ps x , vsj), and (pc^vcj) are the 
unique elliptic curve key pairs of H, B, and I, respec- 
tively. Suppose H has an authentic and actual copy of 

30 Cert B which signature was verified with the authentic 

copy of vsj and the B has an authentic and actual copy of 
CertH which signature was verified with the authentic 
copy of vs j . Then the same phases as for the individual 
watermark protection apparatus have to be applied. 

35 Remark: 

Since the generated asymmetric key pairs are * 
unique, the ICH can be uniquely identified if no addi- 
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tional watermarks by unauthorized persons have been en- 
coded into the SI of the ICH. The ICO based watermark 
protection provides the necessary counter measures to 
prevent this threat. 

c) ICO based watermark protection: 
As shown in Fig. 3, he apparatus for the ICO 
based watermark protection is partitioned into four proc- 
esses, namely the ICH with the name H, the IB process 
with the name B, the PKI process with the name I, and the 
ICO process with the name 0. Suppose (ps^/ vsh) / (P^w 
vc H ) , (ps B ,vs B ), (pc B/ vc B ), (ps!,vsj) (pcj, vcj), (ps 0 / 
vsq) / and (pcq/VCq) are the unique elliptic curve key 
pairs of H, B, I and 0, respectively. H has an authentic 
copy of Cert B and CertQ whose signatures were verified 
with the authentic copy of vsj, B has an authentic copy 
of Certj} and CertQ whose signatures were verified with 
the authentic copy of vsj, and 0 has an authentic copy of 
Certft and Cert B whose signatures were verified with the 
authentic copy of vsj . 

The following phases are applied by the proc- 
ess.es*.. of. the t ICO ba sed ~c opy*rig>h t-^p-r o.t e c-t -i o,n ^a pp a r a t u s : 
Phase 1 to Phase 3 : See Phase 1 to Phase 3 of the Indi- 
vidual watermark protection. 
Phase 4: 

H stores the resulting stego image SI, 
Phase 5: 

H and 0 execute the following steps for the secure regis- 
tration or validation of copyright requests, and the gen- 
eration of copyright certificates. 

1. H and 0 execute 

AKAP(H, 0, K H0 / ps H , vs H , pc H/ vc H , ps G / vs 0 , pc 0 , 
vc 0 ) 

for the generation of a shared symmetric session key Kjj B . 

2. H retrieves the CRD and generates the copyright re- 
quest CR, 

CR := <K HB [TD| I SigTD]>, with 



TD := CRDll TVPlI hI I O, and DSSAP G (ps H , TD, SigTD) . 
H then transmits CR to O. 

3. O receives CR, deciphers K HB [TE)| I SigTD], and verifies 
TD, applying 

5 DSSAPv(vs H / SigTD, IVR) 

where IVR denotes the intermediate verification result. 
If 

IVR = crh(TD), with TD := CRDl I TVPl I h| I O, 
then TD has been successfully verified and the next step 

10 shall be executed. In any other case, the processing and 
communication between the H and O is stopped. 
O verifies the CRD with respect to legal copyright issues 
(uniqueness, originality, etc.). If the data has been 
successfully verified then the next step shall be exe- 

15 cuted. In any other case, the processing and communica- 
tion between the H and O is stopped. 

4. If verification was successful, O generates the corre- 
sponding digital copyright certificate executing 

DSSAP(3(psQf CCD, SigCCD) . 
20 O then stores the copyright certificate CC := CCDlIsigCC 
and generates then the Copyright Confirmation Reply CCR 
CCR := <K ho [TD| I SigTD]>, with 

TD := Cell TVPl loll H, and DSSAP G (ps 0 , TD, SigTD). 
O then transmits CCR to H. 
25 5. H receives CCR, deciphers K HO [TDl I SigTD], and verifies 
TD, applying 

DSSAPy(vsH/ SigTD, IVR) , 
where IVR denotes the intermediate verification result. 
If IVR = crh(TD), with TD := cd I TVPl I ol I H, then TD has 
30 been successfully verified. H then verifies and stores 
the CC. 

The following phase can now be executed repeatedly, if 
necessary, without repetition of the previous phases. 
Phase 6: 

35 H and B execute the following steps for the trading of 
copyright protected digital images: 
1. H and B execute 
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AKAP(H, B, K HB , ps H , vs H/ pc H , vc H , ps B , vs B , 
pc B , vc B ) 

for the generation of a shared symmetric session key K HB . 

2. B generates the trading transaction Tl, 
5 Tl := <K HB [TD|I SigTD]>, with 

TD := ID CI II TVPlI b| I H, and DSSAP G (ps B , TD, SigTD) . 
B then transmits Tl to H. 

3. H receives Tl, deciphers K HB [TD| I SigTD], and verifies 
TD, applying 

10 DSSAP v (vs B , SigTD, IVR) 

where IVR denotes the intermediate verification result. 
If 

IVR = crh(TD), with TD := ID CI I I TVPl I b| I H, 
then TD has been successfully verified and the next step. 
15 shall be executed. In any other case, the processing and 
communication between the H and B is stopped. 

4. If the verification was successful, H retrieves with 
the IDcj information the corresponding stego image SI and 
generates the trading transaction 

20 T2 := <K HB [TD| I SigTD]>, with 

TD := SI NtVpIIhIIb, and DSSAP G (ps H , TD, SigTD). 
H th^rr trr^-s^ 

5. B receives T2, deciphers K hb [Td| I SigTD], and verifies 
TD, applying 

25 DSSAP v (vs H , SigTD, IVR), 

where IVR denotes the intermediate verification result. 
If IVR = crh(TD), with TD := Sill TVPl I Hi I B, then TD has 
been successfully verified. B stores then the SI. 

30 Remark: 

B may check the copyright certificate re- 
questing O to transfer an authentic copy of the copyright 
certificate for a given image identifier ID C j. Except the 
data transferred, the applied protocol is the same as de- 
35 scribed in phase 4 . 

If B would like to transfer a specific copy- 
right of a CI to another legal party, he may initiate a 



copyright revocation request with 0. The different phases 
of this request are analogue to the copyright request. 

The method described in this section II re- 
5 quires a suitable watermarking technique. Various such 
techniques are known and can be employed. However, a pre- 
ferred technique is described in the next section. 



10 III. Embedding the watermarks 

The watermarking technique described here 
comprises the following steps: 

a) An error-control coding technique for the 
is message to be transmitted in the watermark; 

b) A encoding technique to encode the message 
resulting from step a) ; 

c) A reliable method for embedding the en- 
coded message from step b) in the image without introduc- 

20 ing visible artifacts. 

Each of these three aspects can be applied to 
conventional watermarking techniques. Preferably, they 
are used in combination to provide a highly reliable, ro- 
bust and powerful method for marking data sets. This 
25 method can be applied for any watermarking applications, 
in particular to the application described in section II 
of this disclosure. 

Steps a) and b) can be used for embedding wa- 
termarks in any type of data while step c) is optimized 
30 for embedding watermarks in images. 

In the following, the three elements of the 
watermarking technique are described in detail. 



35 



III. a) Error control coding 

Error control coding is applied to the mes- 
sage prior to encoding step III. a). When used in combina- 
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tion with the procedure described in section II, the mes- 
sage corresponds to one of the blocks BLj_ . 

Preferably, symbol based Reed Solomon (RS) 
codes are applied for this purpose* The advantages are 
5 the following: 

- RS codes correct symbol errors rather than 
bit errors, and 

- RS codes can correct erasures as well as 
errors. Erasures can be factored out of the key equation, 

10 which means that "erased" symbols can be ignored. They do 
not play any role in the error control mechanism - an 
erasure is useless redundancy. 

Being able to discard erased symbols has two 

advantages : 

15 - If the posterior probability of a received 

symbol is low, it may be ignored. 

- RS codes only come in standard sizes. For 
example a 255 x 8 bit code is common. Most commonly used 
RS error control codes appear to be too large to be used 

20 in watermarking. However, it is possible to make almost 

any RS code fit a watermarking application by judiciously 
s e l*e e t in*g^ -s*ymb ©*>s~ -a^s^b^Mrg e^a*s f e r d^(^e r e*a fc u*s^e^^he^y ^e-pe^ ~* 
never embedded in the image in the first place) . 

25 Ill.b) Encoding the message 

During encoding, the message to be transmit- 
ted in the watermark is transformed into a form suited 
for being used in the modulation of image components. At 

30 the same time, it is encrypted using a suitable key. 

If used with the method of section II, the 
encoding procedure has access to the cryptographic keys 
PH and v^ (or their hash values) , which are applied as 
seeds to generate pseudo-random sequences as described 

35 below. The public key is used for encoding the message of 
the public watermark, the private key is used for the 
private watermark. Knowledge of the corresponding key (or 



23 



hash value) is required for recovering the message from 
the watermark. 

A watermark may be embedded or extracted by 
the key owner. In this form spread spectrum is a symmet- 
5 ric key cryptosystem. From the point of view of embedding 
watermarks in images given the cryptographic keys the se- 
quences themselves can be generated. A good spread spec- 
trum sequence is one which combines desirable statistical 
properties such as uniformly low cross correlation with 

10 cryptographic security. 

Suppose we are given a message B (e.g. that 
was provided with error coding in above step III. a). The 
message has the binary form bib2.-.bL, where bj_ are its 
bits. This can be written in the form of a set of symbols 

15 S1S2 - . • sjsj - most generally by a change in a number 

base from 2 to B. The next stage is to encode each symbol 
Si in the form of a pseudo random vector of length N, 
wherein each element of this vector either takes the 
value 0 or 1. N is e.g. in the order of 1000 to 10000 

20 (typically in the order of 10% of the total number of im- 
age coefficients (Fourier components) that can, theoreti- 
cally, be modulated) . 

In a preferred embodiment, this is carried 
out by using a pseudo random generator seeded by the key 

25 crh(p H ) or crh(v H ). 

To encode the first symbol a pseudo random 
sequence v of length N + B - 1 is generated. To encode a 
symbol of values where 0 < s < B the elements v s , v s + i 

V s+N-1 are extracted as a vector ri of length N . For 

30 the next symbol another independent pseudo random se- 
quence is generated and the symbol encoded as a random 
vector r2 . Each successive symbol is encoded in the same 
way. Note that even if the same symbol occurs in differ- 
ent positions in the sequence, no collision is possible 

35 because the random sequences used to encode them are dif- 
ferent - in fact they are statistically independent. Fi- 




nally the entire sequence of symbols is encoded as the 
summation : 

m =2i=i. . m 

The pseudo-random vector m has N elements, 
5 each varying between 0 and M . In a next step, the ele- 
ments of m are offset to make their mean zero. These ele- 
ments will determine the strength of modulation of the 
Fourier components of the image in step III.c. 

When decoding the watermark, a vector m' 
10 (read-out message) is derived from the stego-image. In 
oblivious watermarking, m' corresponds to the modulated 
Fourier coefficients. Hence, in general m' will not be 
equal but "similar" to m. 

To decode s from m' , the elements of m' are 
15 first offset to make their mean zero. Then, starting from 
the (known) seed, the first random sequence v of length N 
+ B - 1 is generated and the correlation of v with m' is 
calculated. The peak of the correlation indicates the 
offset si in the random sequence that was used for gener- 
20 ating # Then, the next random sequence v is generated 
and cross-correlated with m' to retrieve S£/ etc. 
^ , ^^^^ »the apparatos**a^e 

best accommodated by using m-sequences that possess mini- 
mum cross correlation with each other. This is the same 
25 as maximizing the Euclidean distance between vectors v^, 
v 2 , v 3 ... . 

If M is sufficiently large, the statistical 
distribution of the message m should approach a Gaussian 
(Central Limit Theorem) . A Gaussian distributed watermark 
30 has the advantage that it is more difficult to detect. 
The variance increases with order M 1//2 ; in other words, 
the expected peak excursion of the sequence is only order 
M l/2. 

35 III.c) Embedding the message in the image 



In this step, the encoded message m (e.g. as 
obtained in the previous step) is applied to the image 
for generating the watermark. 

In contrast to steps III. a) and Ill.b), em- 
5 bedding the message in the image requires some knowledge 
of the nature of .the data stored in the image. In the 
following, the image is assumed to be a two-dimensional 
image. The method is optimized for robustness against op- 
erations generally applied to images such as translation, 
10 cropping, rotating, scaling. (The method is not optimized 
for other types of data, such as sound or text.) 

In order to achieve robustness against circu- 
lar translation, the image block is first subjected to a 
Fourier transform. Then, message m is used to modulate 
15 the Fourier components. In addition to this, a template 
is embedded in the image, which template can be used for 
detecting a rotation and scaling of the image when read- 
ing the watermark. A tiling mechanism and suitable phase- 
dependent correction are applied for providing robustness 
20 against cropping. 

Figure 4 shows a detailed diagram describing 
the embedding of the watermark. Calculation starts from 
the. cover image : 

1. If the image is a color image, then compute the lumi- 
25 nance component (by replacing each pixel by g/2 + r/3 

+ b/6, where g, r and b are its green, red and blue 
components) and use these values for the following 
calculations . 

2. Divide the image into adjacent blocks of size 128 x 
30 128 pixels. 

3. Map the image luminance levels (or gray levels for a 
black and white image) because it corresponds to a 
perceptually "flat" domain by replacing them with 
their logarithm. The logarithm is a good choice be- 

35 cause it corresponds of the Weber-Fechner law which 

describes the response of the human visual system to 
changes of luminance. 



Compute the FFT (Fast Fourier Transform) of each 
block. From the real and imaginary components obtained 
in this way, calculate corresponding magnitude and 
phase components. 

The magnitude components are translation invariant and 
will therefore be used in the following modulation 
steps. (However, it is possible to derive translation 
invariants from the phase spectrum as well, which 
could also be modulated) . 

Select the magnitude components to be modulated. To 
encode a message m of length N, a total number of N 
components are modulated. In non-oblivious watermark- 
ing, any components can be modulated. For oblivious 
watermarking, because of interference of the cover im- 
age with the watermark, the largest (highest energy) 
components (at about the lowest 10% of the frequen- 
cies) are avoided and components at medium frequencies 
(about next 30%) are used. These figures are chosen 
because they generally give a good compromise between 
robustness and visibility of the watermark. 
There are two methods for selecting the components to 
~to&^G&wkegfc& &* « " - * - - • •>* -<~ — ••• 

a) The selection of the components to be modulated 
does not depend on the given image. Rather, the 
same components are selected for every image. The 
author as well as the reader of the watermark know 
the positions of the components to be selected in 
advance . 

b) The largest components (inside the allowable fre- 
quency range) are used for modulation. 

When selecting the components to be modulated, care 
must be taken to preserve the symmetry imposed on the 
Fourier components F(ki, k2) by the fact that the im- 
age block is real valued: 

F(ki, k 2 ) = F* (Nx - k x , N 2 - k 2 ) 
(where N^, N 2 designate the size of the image block) . 
Once the magnitude components (M^, . . . 1%) to be modu- 
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lated are chosen, the corresponding value of mes- 
sage m is added to or subtracted from the correspond- 
ing selected magnitude component M-[ . Addition is used, 
if the corresponding phase component P-^ is between 0 
5 and n, subtraction if it is between n and 2n. This 

provides robustness against translation and cropping 
(see below) . 

Before adding/subtracting the values m^ to/from M-^, 
the vector m can be scaled to adjust the magnitude of 

10 its elements to those of the components M-^ . 

Generally, the elements mj_ should be in the same order 
of magnitude as the components . The depth of modu- 
lation or amplitude of the embedded signal should de- 
pend on the objective measure of the perceptual sig- 

15 nificance. The lower the perceptual significance, the 

higher should be the amplitude of the watermark. How- 
ever, for simplicity, the amplitude for all components 
is kept constant. 

6. Add a template by a second modulation of the magnitude 
20 components. This is described in more detail below. 

7. Compute the inverse FFT using the phase components and 
the modulated magnitude components. 

8. Compute the inverse of the perceptual mapping function 
of step 3. For Weber-Fechner law mapping, the inverse 

25 function is an exponential. 

9. Replace each watermarked block in the image to obtain 
the stego image. 

10. If the image is a color image, then rescale the red, 
green and blue components by the relative change in 
30 luminance introduced by embedding a watermark. Typi- 

cally, the red, green and blue pixels occupy a byte 
each in program memory. If overflow or underflow oc- 
curs then the pixel is set to the upper bound 255 or 
lower bound 0 respectively. 
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Template : 

As mentioned above, a template is added to the image in 
step 6. The steps for generating the template are illus- 
trated in Fig. 5: 
5 20. Apply a log-polar map to the magnitude components, 
i.e. transform them into a polar coordinate system 
(0, log-r) with logarithmic radius axis. 
In this representation, a scaling of the image leads 
to an offset of the components along the log-r axis. 
10 A rotation of the image leads to an offset along the 

0 axis. 

Preferably, low pass filtering is used for interpo- 
lating the frequency space components during this 
mapping, 

15 The magnitude components belonging to very low or 

high frequencies are not mapped. The following modu- 
lation is only applied to components in medium fre- 
quency range. 

21. Select the magnitude components in the log-polar co- 
20 ordinate system to be modulated. Typically, about 10$ 

of all components are to be modulated. 

in 

log polar space should be such that its auto- 
correlation under translation is weak. For this pur- 
25 pose, the indices of the selected components should 

be coprime or be derived from a two-dimensional ran- 
dom sequence. 

Each selected component is increased by a given 
value . 

30 22. Map the modulated points by change of coordinates 
back into frequency space. 
The pattern T formed by the selected components in log 
polar space is predefined and known to the reader of the 
watermark . 

35 It must be noted that the calculation of the log-polar 
transform is not required for generating the template. 
Instead of this, the pattern T of the components to be 




29 



modulated in log-polar space can be mapped back to fre- 
quency space, which results in a pattern T" in frequency 
space that can be applied directly to (e.g. added to) the 
components in frequency space. 
5 As will be explained below, the template is not required 
for non-oblivious watermarking. 

Figure 6 shows a detailed diagram illustrating the steps 
for reading a watermark from the stego image: 
10 31. If the image is a color image then compute the lumi- 
nance component and use these values for the follow- 
ing calculations. 
32. Divide the image into adjacent blocks of size 128 x 



15 33. Map the image luminance levels (or gray levels) to 
the perceptually "flat" domain by replacing them 
with their logarithm. 

34. For each block compute the FFT. 

35. Determine the rotation and scaling that the image 

20 suffered by finding the template in log-polar space. 

This is described below. 

36. Using the results of step 35, read the modulated 
components to generate message m' . This requires the 
knowledge of the method that was used in step 5 for 

25 selecting the components to be modulated. 

Once that the message m' is recovered, it is demodulated 
and error corrected using the methods described in sec- 
tions III. a) and Ill.b). 

30 Finding the template: 

The steps for finding the template are illustrated in 
Fig. 7: 

40. Apply log-polar mapping to the magnitude components 



128. 
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of the Fourier transform. The magnitude components 
belonging to very low or high frequencies are not 
mapped. The following analysis is only applied to 
components in medium frequency range 



30 

41. For oblivious watermarking, calculate the normalized 
cross correlation of the components in log-polar 
space with the template pattern T that was used for 
generating the template in step 21 and find the 
5 point of best correlation. If the image has neither 

been rotated or scaled, this point is at zero. Scal- 
ing leads to a corresponding offset along the log-r 
axis, rotation to a corresponding offset along the 0 
axis . 

10 For non-oblivious watermarking, the log polar trans- 

form of the Fourier components of the cover image 
can be used instead of template pattern T for re- 
trieving scaling and rotation. 

The cross correlation can be calculated efficiently 
15 using conventional Fourier techniques. 

Properties of the watermark: 

In the following, some of the properties of 
20 the watermark generated using the steps described above 
are discussed. 

Resistance to cropping: 

One feature of translation invariants devel- 

25 oped using the Fourier transform is that they are invari- 
ant to circular translations (or cyclic shifts) . This is 
used to construct watermarks that are invariant to crop- 
ping. This is illustrated by reference to Figs. 8 and 9. 

As mentioned above, the image is split into 

30 blocks and the watermark is applied to each block. In 
other words, the same modulation pattern is applied to 
the Fourier components of each block, wherein the modula- 
tion pattern is given by the corresponding encoded mes- 
sages m. 

35 Fig. 8 shows such an image where the fat 

lines 100 designate the borders between the blocks. Sup- 
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pose that the watermark in a standard size block will be 
of the form: 

T=[A B ; C D] 

where the submatrices A, B, C and D are of 
5 arbitrary size. A circular translation of such a water- 
mark is of the form: 

S=[D C ; B A] . 

The original stego image is tiled with water- 
marks in the pattern [T T T T ; T T T T ; T T T T] . There- 

10 fore, a cropped section of the matrix will carry a water- 
mark in the form [S S S S ; S S S S ; S S S S] . This is 
illustrated in Figure 9. When reading the watermark of 
the cropped image of Fig. 9, each block carries the wa- 
termark S. Since S is a circular transform of T, it can 

15 be read without problems in the Fourier domain using the 
steps outlined above. 

Note, however, that the cover image is not 
tiled, only the watermark is. Therefore, while cropping 
merely induces a circular translation of the watermark in 

20 each block, the change of image in each block is not a 
circular translation. To compensate for this, the phase 
components Pj_ of the Fourier transform must be used for 
correcting the sign of the modulation of the magnitude 
components H±, as it is outlined under step 5 above. 

25 The optimum size of block depends on a number 

of different factors. A size that is a power of two is 
useful because the FFT can be used. The block size also 
must be small enough to withstand cropping but large 
enough to comfortably contain a watermark. The best com- 

30 promise for block size is 128. 

Resistance to scaling and rotation: 

As mentioned above, reading the template in 
log-polar space allows to detect and measure any scaling 
35 and/or rotation that was applied to the image. This in- 
formation can then be used for reading the watermark. 
Since the reader knows the pattern that was used for 




modulating the magnitude components in step 5, he can 
identify the modulated components in the scaled and ro- 
tated image and derive the message m' therefrom. 

Note that the apparatus does not explicitly 
5 use a rotation and scale invariant watermark but instead 
searches the parameter space of rotations and scales. 
Since searching the space of rotation and scales in the 
frequency or space domain is quite complicated, the log- 
polar map is used where these parameters are Cartesian 
10 coordinates and can be searched using efficient correla- 
tion techniques. 

Redundancy: 

The watermark is embedded in blocks of a 
15 fixed size with exactly the same watermark embedded in 
each block. This means that the watermark can be recov- 
ered from a single block only. This leads to a redundancy 
that increases the chance of extracting the watermark 
correctly from more than one block. 



The following summarizes some of the proper- 
25 ties of the preferred embodiments of the invention. 

The use of an asymmetric cryptographic key 
pair for the seed generation enables the execution of 
asymmetric key agreement protocols with message recovery 
or appendix and the protection of the communication be- 
30 tween the involved parties. Different security services 
for the communication, such as mutual authentication, in- 
tegrity, confidentiality and non-repudiation are sup- 
ported by the system with one asymmetric cryptographic 
key pair of the watermark author only for a registration 
35 or trading process 

The present technique enables a strong bind- 
ing relation between the image ID, the image, and the ICH 
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if the ICH registers his copyright at the ICO. If an im- 
age is watermarked later by an unauthorized person, the 
time stamp in the copyright certificates resolves the 
copyright ownership . 



cryptographic key if ownership verification has to be ap- 
plied by a different legal party. 

The present technique supports transferral of 
copyrights. If copyright is transferred to another legal 

10 party, corresponding copyright revocation certificates 
may be generated. 

Digital signatures techniques are applied for 
the security of the communication between different par- 
ties and the authentication data embedded in a private or 

15 public watermark of an image. No signature labeling tech- 
niques of the complete image are applied by the system. 

The Fourier-Mellin transform has been en- 
hanced as described above. The Fourier Mellin Transform 
is the Fourier Transform of a log polar map. In the pres- 

20 ent invention, the log polar map of a Fourier transform 
is used as a means of facilitating rotation and scaling 
invariance . 

Circular translation invariants are used as a 
means of constructing digital watermarks that are invari- 

25 ant to cropping. 

In contrast to some known techniques, the 
present system does not require a database of all water- 
marks that were ever embedded in image anywhere. 

Information is embedded and/or retrieved in 

30 the log polar domain of the Fourier transform. Frequency 
components are modulated which are oblivious to the cover 
image but which also have the property that they form an 
unambiguous non-repeated pattern in log-polar space. They 
are used for determining the degree of rotation and scal- 

35 ing suffered by a stego-image in the absence of the 

cover-image. Coprime frequencies are useful for generat- 
ing such a pattern or template. Uniform random sampling 
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The ICH does not have to reveal his private 



of log polar space is another method that can be applied. 

The technique applies a new concept of in- 
variants which are based on the modification of the well 
known FM transform and the coprime frequencies. 
5 The methods described above can be incorpo- 

rated into an apparatus, such as one or more computers, 
using know programming and hardware techniques. To prove 
the feasibility of the approach, a Java based copyright 
protection and authentication environment for digital im- 
10 ages has been implemented. The PKI, the ICH, the ICO, and 
the IB application processes all implement a Graphical 
User Interface and a server, supporting both console us- 
ers and other requests through a socket interface. 




Claims 

1. A method for generating and transmitting a 
data set between two parties H and B comprising the steps 

5 of 

a) providing a cover data set (CI) corre- 
sponding to the data set to be transmitted, 

b) generating a stego data set (SI) of said 
cover data set (CI) by embedding at least one digital wa- 

10 termark in said cover data set (CI), wherein said water- 
mark is encoded using at least one key of an asymmetric 
cryptographic key pair (psjj, vsjj) of H, said key pair 
comprising a secret private key (psj^) and a known public 
key (vsjj) derived therefrom, 

15 c) establishing a cryptographically secure 

transmission between parties H and B with a key protocol 
using at least said key pair (pspj, vs^) of H, 

d) transmitting said stego data set (SI) from 
said party H to said party B within said secure transmis- 

20 sion. 

2. The method of claim 1, wherein said cryp- 
tographically secure transmission between said parties H 
and B is established using an asymmetric key protocol 
(AKAP(H,B,K HB ,ps H/ vs H ,ps B , vs B ) ) based on said key pair 

25 (psjj/ vsjj) of H and a private and public asymmetric cryp- 
tographic key pair (ps B , vs B ) of B for generating a com- 
mon key (K^g) between said parties H and B. 

3. The method of one of the preceding claims 
wherein said key pair (psjj/ v sh) of H is an elliptic 

30 curve key pair. 

4. The method of one of the preceding claims 
wherein said step b) further comprises the steps of 

generating at least one private watermark, 
wherein said private watermark is encoded using said pri- 
35 vate key (ps^) of H, and preferably also 
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generating at least one public watermark, 
wherein said public watermark is encoded using said pub- 
lic key (vsh) of H - 

5. The method of claim 4 wherein said private 

5 watermark is encoded using a hash value (crhtps^)) of 
said private key (ps H ) and can be decoded by using said 
hash value (crh(ps H )). 

6. The method of one of the preceding claims 
wherein said step b) comprises the step of generating at 

10 least one public watermark, wherein said public watermark 
is encoded using a hash value (crh(vs H ) ) of said public 
key (vsj}> of H. 

7. The method of one of the preceding claims 
wherein said step b) comprises the steps of 

15 i) providing a message (s^, S2f •••/ sj^) to 

be transmitted in said at least one watermark, said mes- 
sage consisting of a plurality of symbols, 

ii) providing a pseudo random generator 
seeded with a seed value derived from at least one key of 

20 said key pair (ps H , vs H ) of H or a hash value thereof, 

iii) encoding said message using values from 
s*a i d^s*e^d'© rendom 

8. The method of claims 7 wherein said step 
iii) comprises 

25 for each of said symbols (s^), calculating a 

symbol vector (r-j,), wherein all elements of said vector 
are derived from numbers from said pseudo random genera- 
tor, 

adding said symbol vectors (rj_) to generate 
30 an encoded message (m) and using said encoded message for 
embedding said watermark . 

9. The method of claim 8 wherein for each of 
said symbols (s^) said pseudo random generator is used 
for generating a pseudo random sequence of numbers (v^, 

35 V2/ ..-)/ and wherein the value of said symbol (s^) is 

used for selecting a sub-sequence within said pseudo ran- 
dom sequence for forming said symbol vector (rj) . 
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10. The method of one of the claims 8 or 9 
comprising the following steps for decoding said water- 
mark: 

extracting a read-out message (m' ) from said 
5 watermark, said read-out message being a vector having 
the same length, if erased elements are replaced by zero, 
as said symbol vectors (r-jj , 

generating all possible values of said symbol 
vectors (r±) using said pseudo random generator seeded 
10 with said seed and calculating the correlation between 
all said possible values and said read-out message (m' ) 

11. The method of claims 9 and 10 comprising 
the step of calculating the cross-correlation between 
said pseudo random sequences of numbers (v^, . ..) and 

15 said read-out message (m' ) for retrieving said symbols 
(si) . 

12. The method of one of the preceding claims 
comprising the step of encoding a message for being em- 
bedded in said watermark by using symbol based Reed Solo- 

20 mon codes . 

13. The method of one of the preceding claims 
characterized in that said step b) further comprises the 
step of calculating a logarithm of said cover data set 
(CI) before embedding said watermark for embedding said 

25 watermark in a perceptually flat domain. 

14. Method for generating a stego data set 
(SI) of a cover data set (CI) especially for step b) of 
one of the preceding claims comprising the steps of 

generating at least one message (IADci)/ 
30 applying a digital signature to said message 

(IAD CI ) using an asymmetric cryptographic key pair (p H , 

generating said stego data set (SI) of said 
cover data set (CI) by generating at least one digital 
35 watermark in said cover data set (CI), wherein said wa- 
termark contains said message (IAD C j) . 
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15. Method for generating and transmitting a 
data set between two parties H and B, especially of one 
of the preceding claims, comprising the steps of 

providing a cover data set (CI) corresponding 
5 to the data set to be transmitted, 

generating a stego data set (SI) of said 
cover data set (CI) at a party H by generating at least 
one digital watermark in said cover data set (CI), 

transmitting said stego data set (SI) to a 
10 registration party (O) , and 

permanently storing certification data (CCD) 
at said registration party (O) , said certification data 
comprising a hash value of said stego data set (SI) , a 
digital time stamp (TVP) and information designating said 
15 party H. 

16. The method of claim 15 further comprising 
the steps of generating a digital signature of said cer- 
tification data (CCD) using an asymmetric cryptographic 
key pair (ps 0 / vs 0 ) of said registration party (O) , 

20 transmitting said certification data (CCD) and said digi- 
tal signature to said party H, and verifying said digital 
signature ~at s aid p^ key (vs 0 ) o f 

said key pair of said registration party. 

17. Method for generating and verifying a wa- 
25 termark in a cover data set (CI) representing a cover im- 
age, especially for step b) of one of the preceding 
claims, comprising the following steps for generating 
said watermark 

A) calculating the Fourier transform of at 
30 least part of said cover image for generating Fourier 

components of said cover image, and 

B) modulating at least part of said Fourier 
components using a template modulation pattern (T' ) , 

C) using the inverse Fourier transform for 
35 generating a stego image, 



said method further comprising the following steps for 
verifying said watermark in a possibly scaled and/or ro- 
tated version of said stego image, 

D) calculating the Fourier transform of the 

5 possibly scaled and/or rotated version of said stego im- 
age for generating Fourier components of said stego im- 
age, 

E) calculating a log-polar transform of said 
Fourier components of said stego image, and 

10 F) calculating the cross correlation between 

a log-polar transform (T) of said modulation pattern (T' ) 
and said log-polar transform of said Fourier components 
of said stego image for evaluating a scaling and/or rota- 
tion factor, 

15 18. The method of claim 17 wherein said step 

B) further comprises the steps of 

calculating a log-polar transform of said 
components of said cover image for generating log-polar 
components, 

20 modulating said log polar components using a 

log-polar transform (T) of said modulation pattern (T" ) . 

19. Method for generating a watermark in a 
cover data set (CI) representing a cover image especially 
for one of the preceding claims, characterized by the 

25 step of dividing said image into a plurality of adjacent 
blocks and by the following steps carried out for each 
block : 

calculating the Fourier transform of the 
block of the block, and 
30 modulating at least part of the magnitude 

components of the Fourier transform of the block using a 
modulation pattern, wherein the same modulation pattern 
is used for all blocks. 

20. The method of claim 19, wherein the modu- 
35 lation pattern determines values to be added and/or sub- 
tracted for each of said magnitude components and 
wherein, at each frequency, the corresponding phase com- 
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ponent of the Fourier transform is used for determining 
if said value is to be added or subtracted from said mag 
nitude component. 




Abstract 

A method for generating digital watermarks 
and for exchanging data containing such watermarks is de- 
5 scribed. The system is based on an watermarking technique 
which is robust against image transformation techniques 
such as compression, rotation, translation, and scaling. 
It uses modulation of the magnitude components in Fourier 
space and adds/reads a template in the log polar trans- 

10 form of the magnitude components. The template is used 

for analyzing scaling and rotation. In addition, the sys- 
tem applies cryptographic protocols and public key tech- 
niques for both, encoding the watermark and transferring 
watermarked data. Preferably, an author (ICH) encodes the 

15 watermark using an asymmetric cryptographic key pair pro- 
vided by a public key infrastructure (PKI) and registers 
the watermarked data at a trusted registration party 
(ICO) before transmitting the data to a receiving party 
(IB) . The latter can use the public key infrastructure 

20 (PKI) for verifying authorship. Transmission between the 
parties uses data protection provided by the crypto- 
graphic keys. 

(Fig. 3) 
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